Skip to content

Commit 02a405a

Browse files
kaibernhardkaibernhard
authored
Add tests for sha256-rsa-MGF1 (#515)
1 parent 8e692cf commit 02a405a

File tree

7 files changed

+416
-0
lines changed

7 files changed

+416
-0
lines changed

‎test/saml-response-tests.spec.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,38 @@ describe("SAML response tests", function () {
2323
expect(sig.getSignedReferences().length).to.equal(1);
2424
});
2525

26+
it("test validating SAML response with sha256-rsa-MGF1", function () {
27+
const xml = fs.readFileSync("./test/static/valid_saml_sha256_rsa_mgf1.xml", "utf-8");
28+
const doc = new xmldom.DOMParser().parseFromString(xml);
29+
const signature = xpath.select1(
30+
"/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
31+
doc,
32+
);
33+
isDomNode.assertIsNodeLike(signature);
34+
const sig = new SignedXml();
35+
sig.publicCert = fs.readFileSync("./test/static/idp_certificate.pem");
36+
sig.loadSignature(signature);
37+
const result = sig.checkSignature(xml);
38+
39+
expect(result).to.be.true;
40+
});
41+
42+
it("test validating SAML response with sha256-rsa-MGF1 fails for modified file", function () {
43+
const xml = fs.readFileSync("./test/static/invalid_saml_sha256_rsa_mgf1.xml", "utf-8");
44+
const doc = new xmldom.DOMParser().parseFromString(xml);
45+
const signature = xpath.select1(
46+
"/*/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
47+
doc,
48+
);
49+
isDomNode.assertIsNodeLike(signature);
50+
const sig = new SignedXml();
51+
sig.publicCert = fs.readFileSync("./test/static/idp_certificate.pem");
52+
sig.loadSignature(signature);
53+
const result = sig.checkSignature(xml);
54+
55+
expect(result).to.be.false;
56+
});
57+
2658
it("test validating wrapped assertion signature", function () {
2759
const xml = fs.readFileSync("./test/static/valid_saml_signature_wrapping.xml", "utf-8");
2860
const doc = new xmldom.DOMParser().parseFromString(xml);

‎test/signature-unit-tests.spec.ts‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,75 @@ import * as crypto from "crypto";
66
import { expect } from "chai";
77
import * as isDomNode from "@xmldom/is-dom-node";
88

9+
const signatureAlgorithms = [
10+
"http://www.w3.org/2000/09/xmldsig#rsa-sha1",
11+
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
12+
"http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1",
13+
"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
14+
];
15+
916
describe("Signature unit tests", function () {
17+
describe("sign and verify", function () {
18+
signatureAlgorithms.forEach((signatureAlgorithm) => {
19+
function signWith(signatureAlgorithm: string): string {
20+
const xml = '<root><x attr="value"></x></root>';
21+
const sig = new SignedXml();
22+
sig.privateKey = fs.readFileSync("./test/static/client.pem");
23+
24+
sig.addReference({
25+
xpath: "//*[local-name(.)='x']",
26+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
27+
transforms: ["http://www.w3.org/2001/10/xml-exc-c14n#"],
28+
});
29+
30+
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
31+
sig.signatureAlgorithm = signatureAlgorithm;
32+
sig.computeSignature(xml);
33+
return sig.getSignedXml();
34+
}
35+
36+
function loadSignature(xml: string): SignedXml {
37+
const doc = new xmldom.DOMParser().parseFromString(xml);
38+
const node = xpath.select1(
39+
"//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
40+
doc,
41+
);
42+
isDomNode.assertIsNodeLike(node);
43+
const sig = new SignedXml();
44+
sig.publicCert = fs.readFileSync("./test/static/client_public.pem");
45+
sig.loadSignature(node);
46+
return sig;
47+
}
48+
49+
it(`should verify signed xml with ${signatureAlgorithm}`, function () {
50+
const xml = signWith(signatureAlgorithm);
51+
const sig = loadSignature(xml);
52+
const res = sig.checkSignature(xml);
53+
expect(
54+
res,
55+
`expected all signatures with ${signatureAlgorithm} to be valid, but some reported invalid`,
56+
).to.be.true;
57+
});
58+
59+
it(`should fail verification of signed xml with ${signatureAlgorithm} after manipulation`, function () {
60+
const xml = signWith(signatureAlgorithm);
61+
const doc = new xmldom.DOMParser().parseFromString(xml);
62+
const node = xpath.select1("//*[local-name(.)='x']", doc);
63+
isDomNode.assertIsElementNode(node);
64+
const targetElement = node as Element;
65+
targetElement.setAttribute("attr", "manipulatedValue");
66+
const manipulatedXml = new xmldom.XMLSerializer().serializeToString(doc);
67+
68+
const sig = loadSignature(manipulatedXml);
69+
const res = sig.checkSignature(manipulatedXml);
70+
expect(
71+
res,
72+
`expected all signatures with ${signatureAlgorithm} to be invalid, but some reported valid`,
73+
).to.be.false;
74+
});
75+
});
76+
});
77+
1078
describe("verify adds ID", function () {
1179
function nodeExists(doc, xpathArg) {
1280
if (!doc && !xpathArg) {

‎test/static/idp_certificate.pem‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIFFzCCAv+gAwIBAgIUaAU88KUbZLe7NwTw+jdCHIDU6wIwDQYJKoZIhvcNAQEL
3+
BQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMCAXDTI1MDkwODExMTUzMFoY
4+
DzIxMjUwODE1MTExNTMwWjAaMRgwFgYDVQQDDA9pZHAuZXhhbXBsZS5jb20wggIi
5+
MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXpgSoph176VQPw+4e91UAL6j0
6+
TbL/aI3Amj62TU91KOk4xigy+8xFSeU2IC64W7abfFq+25K+1ybJmMBq94UKyKab
7+
7yeXmen2xJ9PT5br4TwnsbeBZrziXSR8uTE60DdWLZYJEBREgu96JeEWLzP/0Hfn
8+
FlnuG5kXlb6rpy7l723YeDvU9lvsm6Rj46m5R8j4CSenKmLsHSIhmNP59SsEpJ16
9+
D+RfKcrKqxPxp6t/oCEKXjpmOeGoX9WT5V9UMxrGFgY2YLab9tLCIK48i6rgXpHU
10+
nbMq2XyAT58bSG/Tif99hoiQ2ovzsVUrVeCa4/uUg/pr+w1bZnIBl6R8WVPTVwgm
11+
YN+8Ww27aLiNksCn70t74XZLr9xnYnbnj324AiZp9Z48vDECm41Tc+V9eqGNO/5Y
12+
LgZqoGTy4El3AMcNF3lkecZ2UZKMI341pI1vHyRG0jCr2ZYpy30pYQKd+Z7AvZKM
13+
UTJFQfBIOn3zXN6SA8lWZLPOW4VTdOfcGjQij3AUDeTeilUigpRgkTl97WUrGfas
14+
vLXMrdRoXYxjGPe+s4+tf+gnKhTVQ6h6we+ISaFVOeXpCrOUwZM0OdikQtKYgH0G
15+
9OrJKxDZDl4YkkYFqqhyw5Eum9HZwMU8631lkBSqMRgz8AX7KdBn1PrGS6wOp+GC
16+
28L1ISeRxRriWtaeXQIDAQABo1MwUTAdBgNVHQ4EFgQULRbUCREu3zQABqNW8LMO
17+
fraF5BMwHwYDVR0jBBgwFoAULRbUCREu3zQABqNW8LMOfraF5BMwDwYDVR0TAQH/
18+
BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAA6Jm3pll7XHBY/oXrtRAu60RpH4p
19+
cZBSf68zhCQKUnXALy2FWrUGU8uVCJJuxXIcxszTOCZmwVF12YceIFpBrWHxKCDZ
20+
WYDO6hrwZvsa2vh5mXDZo3c/HX6GmJR4f4oIIZnbxFhXR30419PlrwMW3Rk7rnVS
21+
Dz/HpQfdS4y8jYgsm2dIRo+PXQytFRCDj4afsT3eZa27QjFxLTuK+SwkhupSH1WW
22+
YmqL9+iIJiLL/ntfM4MwtOUwcfqI0ttbvFZZIPneBCuEDLn/zJ/QBV3ZvjQDt53W
23+
21HaPGPHBBfVZVroZPvuGvulWRLeECI1Hmbl3al/2aOC0LWzPIk8dlTcN+EWcCEu
24+
fpTOEgkob8waEyxlX0Z5OBjkCHpyDTPGkxBBOCJv88Frx7qdbu8eSV0OviuaM/B7
25+
ky2NbDMKIybX4tf/Q8FNfjPLvTv+8nbrMz6kTno3RR2YC7ttI7Glb/eOg3F/ouF4
26+
wcoPAj+OyU5Q5WJMMaZ9cXF9pwszsglLbFms+WD5PFxlloh6I1hO7TccWKTeUJ5f
27+
YZSYYm31JqWit3DBltXTyRyL7KFSdT/FyRBk62YLCJqJmcukIUJUTya73/RmjW1M
28+
4zMBNaIj/pH77opKWnVbm9F4XnBCG4r9+FRXdV2zKW6DgvDzQ6DaZ+0cwC36vSqk
29+
DyjZYv/tviuWfM8=
30+
-----END CERTIFICATE-----

‎test/static/idp_private_key.pem‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDXpgSoph176VQP
3+
w+4e91UAL6j0TbL/aI3Amj62TU91KOk4xigy+8xFSeU2IC64W7abfFq+25K+1ybJ
4+
mMBq94UKyKab7yeXmen2xJ9PT5br4TwnsbeBZrziXSR8uTE60DdWLZYJEBREgu96
5+
JeEWLzP/0HfnFlnuG5kXlb6rpy7l723YeDvU9lvsm6Rj46m5R8j4CSenKmLsHSIh
6+
mNP59SsEpJ16D+RfKcrKqxPxp6t/oCEKXjpmOeGoX9WT5V9UMxrGFgY2YLab9tLC
7+
IK48i6rgXpHUnbMq2XyAT58bSG/Tif99hoiQ2ovzsVUrVeCa4/uUg/pr+w1bZnIB
8+
l6R8WVPTVwgmYN+8Ww27aLiNksCn70t74XZLr9xnYnbnj324AiZp9Z48vDECm41T
9+
c+V9eqGNO/5YLgZqoGTy4El3AMcNF3lkecZ2UZKMI341pI1vHyRG0jCr2ZYpy30p
10+
YQKd+Z7AvZKMUTJFQfBIOn3zXN6SA8lWZLPOW4VTdOfcGjQij3AUDeTeilUigpRg
11+
kTl97WUrGfasvLXMrdRoXYxjGPe+s4+tf+gnKhTVQ6h6we+ISaFVOeXpCrOUwZM0
12+
OdikQtKYgH0G9OrJKxDZDl4YkkYFqqhyw5Eum9HZwMU8631lkBSqMRgz8AX7KdBn
13+
1PrGS6wOp+GC28L1ISeRxRriWtaeXQIDAQABAoICAGhLJwKngCfu4xRS1mWMicPy
14+
yNwKffDPUIsfLgg94JlRhWXLVCLAK30xLVUdgGryFCEjpcGbcN+yL1SddyXkeqgJ
15+
/aX5pmTH7+LEGiYh4GRJBK5P4WeIV/6EPILDj/8ZN0IK/v54E81Eo+wnyLHRd20X
16+
lf2hjjG9kC9bYSEkVGapAq+ICqvG0BNg/MLAltOAV745sz9CHSCDQIAOKSrAuyLe
17+
ODkR2Yl6rVSSI62iQSuStpgMlWLeSHgFjUYfTxjqNF8rxKpk4LwSRcDUTGAEzkoA
18+
ArhY4o9tKqzllRX9VPPyUCmVuJOR1tCvaXjxahSPARvFLoYtnzqek7GYdNkc3JA8
19+
yMOnXAVfuJ6xML9gFQvCJ9qFL5ayVBi+2OSXpKX0O2AwIOqFilT8/QSoR6bJXMwJ
20+
R4VRtsUbvQ84wG7cRSmGpMWs+PrGOgO2JmjCeLPrSZXNUIYchxGun+nG1OlBMjTc
21+
GdEzUdC0BLwOuGpvTKtCMDvwXStogq1PtjCHvEfjX84jtlV3mvJFHnqIJBGkLQPX
22+
O9P2SVL3g8vNwuAKvfMtSgW2sUXf+nFBtiAFXqXdYy0vL3O4AAoWU8Jfl5EUbO1S
23+
bAGJcF5N9vsSFGDfcZzuAbbSdj6qUlIkncTBlVO/tWsdFIg9BXbH/qQZEaprX//P
24+
5Z5wv+qBL353z7nCkb8zAoIBAQDrBQ8R49u/Pxupvr5pcFfZ14ifmIZnUar1bkig
25+
o/ylb6Si3WgQ5PP788snYp2R3kbo+JBrdyl/OQBWgtCKOXxFllrBjwlihDXnK+SB
26+
igqHCkKbjTMjI+Gkgot7sR+tC9UnM0SNHlX6fkWfbmj6dQIIv0Cd3yOzx/v+ml2w
27+
TUwxCfmroiX67y3Sl0yVAGmXfjQ1uRCLBiulJEfONAu6+it0H8Whtx5d9FglF2Hj
28+
ll+cOamAB+GZiJzAF6MucizS+Cfw+kWkrlOpFj2EqE7Z847Bhp1b6TSPCVZ+IUpY
29+
1FTYIBw1JFe7xeRKsfHs0KgrpSf3AxuSalFfpLeV997+sd/3AoIBAQDq5kPnZZTT
30+
V/i+DCa3Q94gNNQC+6j1YE/PDaQeOS7ybYz6pFizrIn6ioIfKD1as8vViTnvw9kq
31+
CehnO+rOzPA4oloVFDNKqliLViJMz7CY8hRoiOUuLzGbsmTyqvjcSi39IOmWs7Pq
32+
YFE0vDftEimMCxLNuTP/JpSa1ZY9std0Ljkk9zBTAykkXrrmjUxvd938DMSOqAv/
33+
Pnib/Oq5cumROMXpPaRMjvhc56iyfEyluTntpJREN9KHvtll8TrGmDk/WW8sF87t
34+
jmr0hNSa4dFOTkUS+EODL6BPKg+MwGN6UL7L811qztErKtFCK77JGr+dq66fU1bV
35+
y9JHSPYvJ8dLAoIBAQCnSUWNzWwoeEo/jCdLNA1EYXe9ajsZJfeTlXma5r86HvrI
36+
duLRS7cju0f68+YG43oD8JIT/JEMHs3PxnOcQAjmG3zkU+UxO7yGnSac0l5l+vao
37+
dFxXAf5mNAoG9HAAo/CIY6TC8jnvAJycPGH7DPhys3fSJ/foy0vi0Ywopwy5x0jx
38+
U4zHTiKGyO1ZDh8bF1kgeGd/HdhJR0bZTxCeed4eXVM2pfq2k+t+E2O5NNs/f4fY
39+
O0PpHmW9EdY0hE7FqJ/9lpel/fRM4ijN2WOvHf+aXzB5MMkZm2L2ism56wGtiUWq
40+
ygCtBtJWHM2AbJGX54pH9+1TTdw4QS3wUKxpDMHHAoIBAAcs9ZISBlPWciDMGjqq
41+
9hQhyQA2U9j7EjUPA55wvMBnHFFjx9nlQWnH5WWyQv2MVIO3Z2+tmeqw1sqgh/G9
42+
TPFN9FaEgXScc4v+G5ohFhH2Ay2WUPnyMx/AeVj4ZBXGplT/NmOGJc7ZFmH4BfVW
43+
ArLme7KRH8eBlDSOpcJIvlAsQU6hxnYiuJUF18vHMTiOftd+RFrfQ06Ox/xr43e6
44+
zOvEwjb3zRcRnwCniv240laVq/FYf7b9xY6kA9wbXGJIsCcBQmYkbAvRt+60SBJb
45+
J5uuxGlp8BYH1GvWqxbvoZpQ8SMl0gq7OqSI8E+HKpLWIFhesDzpvNNXIJtQ3URf
46+
gLUCggEAa0SzoEaLut65B1mQuYaYXCvyXohRJn49BoHULUub/Zg2D+mPMJcyefBK
47+
o/FUZD8ewXUiEoj6eoEXHTT8eOSvhXQHp2dc6AW6rADzL4Ni0oSQ8LwT5fgGq7B7
48+
yxWXkSkK3T43RLvrb7FSV21WTcsXYH560LHa5me1S4Pb1Zrz8+KCRNdNcoffZMfi
49+
b09pdLkS7Sbiskg69NrOFmwfD8SdAb9opPLY5lLWEVtkaPwQS4MrboJJlDutV9VC
50+
/Ye8QbuMwKQHduhAGGsCpkEwZhO5T4owdebVeY28t80HsInv7mFuiqZbIN/BMnU7
51+
zvi/SKHNm+elLUD1r7tC3+KVTtqSSw==
52+
-----END PRIVATE KEY-----

‎test/static/invalid_saml_sha256_rsa_mgf1.xml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="no"?><samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Destination="https://acs.example.com/" ID="_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" InResponseTo="inResponseTo" IssueInstant="2000-01-01T01:00:00Z" Version="2.0"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
2+
<ds:SignedInfo>
3+
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
4+
<ds:SignatureMethod Algorithm="http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1"/>
5+
<ds:Reference URI="">
6+
<ds:Transforms>
7+
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
8+
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
9+
</ds:Transforms>
10+
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
11+
<ds:DigestValue>bA/90zzLS/36DstvPJRrMNwGax5WQv8NneSuNdLnMYs=</ds:DigestValue>
12+
</ds:Reference>
13+
</ds:SignedInfo>
14+
<ds:SignatureValue>
15+
0fK5rJEtj0+JIL3hAuDsEAuKYoiwHzZTgQgspLyEe+XQan1FzT+qu3GBJSpSDfArBHjHXtizVfi8
16+
irId6a1kOj6ShEw2ZSGYD8Dh2d0HmrHqlOqpZ5eLiWeFA6VTtW1Cqmvr+x4Ndxcg0wWmmGr4hpSD
17+
Yg8fkA8e32Fd2QxqLsQqVlCcuvJVCJ/12XSGcMW+Tse254fN6JENLLUdilu+14NNQKAHpKpjeajg
18+
jG3fn0VNvyVQXKi2deYTWYaLRujBgv3Ncz8t9Hjthk+XxrRVHJiGc6HyVvqdpi5ChM41fjB1+eBo
19+
NkZ0Q73ZSCbTAqVduUWqL5pQzINq16kUm2ovkg7h3JoqSQr5yhoBJXZEf6FEyYdCCLd3rlIrkcvD
20+
+wfF2CwNRc6utgO/05JAA7Z1x2e0K6o2a6EQy93dkUIBhpxPYU/IdmGb15AfKJ3OrB1K/jTrxZ2q
21+
og/u0fJe0vU1sL4EDOXqVMj/unTZqDP/K1mOHK/eDWafs/IwMv65ebZUwTk74AMk/oOYV9mL8beY
22+
JAVYMN+xPA1cXnHlRgwATWLXjfiQcMXo44nhaw0YlOUGIoRLYURqHmXz0W3d8pXYdybLmdClkqLR
23+
vo1ryK1OC2paYG9qwk51QJ5wzMv6HRB5tDIL9/7mP7khlKgm4p+EZXFGYmvYDbk2x219SvxPmfY=
24+
</ds:SignatureValue>
25+
<ds:KeyInfo>
26+
<ds:KeyValue>
27+
<ds:RSAKeyValue>
28+
<ds:Modulus>
29+
16YEqKYde+lUD8PuHvdVAC+o9E2y/2iNwJo+tk1PdSjpOMYoMvvMRUnlNiAuuFu2m3xavtuSvtcm
30+
yZjAaveFCsimm+8nl5np9sSfT0+W6+E8J7G3gWa84l0kfLkxOtA3Vi2WCRAURILveiXhFi8z/9B3
31+
5xZZ7huZF5W+q6cu5e9t2Hg71PZb7JukY+OpuUfI+Aknpypi7B0iIZjT+fUrBKSdeg/kXynKyqsT
32+
8aerf6AhCl46ZjnhqF/Vk+VfVDMaxhYGNmC2m/bSwiCuPIuq4F6R1J2zKtl8gE+fG0hv04n/fYaI
33+
kNqL87FVK1XgmuP7lIP6a/sNW2ZyAZekfFlT01cIJmDfvFsNu2i4jZLAp+9Le+F2S6/cZ2J25499
34+
uAImafWePLwxApuNU3PlfXqhjTv+WC4GaqBk8uBJdwDHDRd5ZHnGdlGSjCN+NaSNbx8kRtIwq9mW
35+
Kct9KWECnfmewL2SjFEyRUHwSDp981zekgPJVmSzzluFU3Tn3Bo0Io9wFA3k3opVIoKUYJE5fe1l
36+
Kxn2rLy1zK3UaF2MYxj3vrOPrX/oJyoU1UOoesHviEmhVTnl6QqzlMGTNDnYpELSmIB9BvTqySsQ
37+
2Q5eGJJGBaqocsORLpvR2cDFPOt9ZZAUqjEYM/AF+ynQZ9T6xkusDqfhgtvC9SEnkcUa4lrWnl0=
38+
</ds:Modulus>
39+
<ds:Exponent>AQAB</ds:Exponent>
40+
</ds:RSAKeyValue>
41+
</ds:KeyValue>
42+
<ds:X509Data>
43+
<ds:X509Certificate>
44+
MIIFFzCCAv+gAwIBAgIUaAU88KUbZLe7NwTw+jdCHIDU6wIwDQYJKoZIhvcNAQELBQAwGjEYMBYG
45+
A1UEAwwPaWRwLmV4YW1wbGUuY29tMCAXDTI1MDkwODExMTUzMFoYDzIxMjUwODE1MTExNTMwWjAa
46+
MRgwFgYDVQQDDA9pZHAuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
47+
AQDXpgSoph176VQPw+4e91UAL6j0TbL/aI3Amj62TU91KOk4xigy+8xFSeU2IC64W7abfFq+25K+
48+
1ybJmMBq94UKyKab7yeXmen2xJ9PT5br4TwnsbeBZrziXSR8uTE60DdWLZYJEBREgu96JeEWLzP/
49+
0HfnFlnuG5kXlb6rpy7l723YeDvU9lvsm6Rj46m5R8j4CSenKmLsHSIhmNP59SsEpJ16D+RfKcrK
50+
qxPxp6t/oCEKXjpmOeGoX9WT5V9UMxrGFgY2YLab9tLCIK48i6rgXpHUnbMq2XyAT58bSG/Tif99
51+
hoiQ2ovzsVUrVeCa4/uUg/pr+w1bZnIBl6R8WVPTVwgmYN+8Ww27aLiNksCn70t74XZLr9xnYnbn
52+
j324AiZp9Z48vDECm41Tc+V9eqGNO/5YLgZqoGTy4El3AMcNF3lkecZ2UZKMI341pI1vHyRG0jCr
53+
2ZYpy30pYQKd+Z7AvZKMUTJFQfBIOn3zXN6SA8lWZLPOW4VTdOfcGjQij3AUDeTeilUigpRgkTl9
54+
7WUrGfasvLXMrdRoXYxjGPe+s4+tf+gnKhTVQ6h6we+ISaFVOeXpCrOUwZM0OdikQtKYgH0G9OrJ
55+
KxDZDl4YkkYFqqhyw5Eum9HZwMU8631lkBSqMRgz8AX7KdBn1PrGS6wOp+GC28L1ISeRxRriWtae
56+
XQIDAQABo1MwUTAdBgNVHQ4EFgQULRbUCREu3zQABqNW8LMOfraF5BMwHwYDVR0jBBgwFoAULRbU
57+
CREu3zQABqNW8LMOfraF5BMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAA6Jm
58+
3pll7XHBY/oXrtRAu60RpH4pcZBSf68zhCQKUnXALy2FWrUGU8uVCJJuxXIcxszTOCZmwVF12Yce
59+
IFpBrWHxKCDZWYDO6hrwZvsa2vh5mXDZo3c/HX6GmJR4f4oIIZnbxFhXR30419PlrwMW3Rk7rnVS
60+
Dz/HpQfdS4y8jYgsm2dIRo+PXQytFRCDj4afsT3eZa27QjFxLTuK+SwkhupSH1WWYmqL9+iIJiLL
61+
/ntfM4MwtOUwcfqI0ttbvFZZIPneBCuEDLn/zJ/QBV3ZvjQDt53W21HaPGPHBBfVZVroZPvuGvul
62+
WRLeECI1Hmbl3al/2aOC0LWzPIk8dlTcN+EWcCEufpTOEgkob8waEyxlX0Z5OBjkCHpyDTPGkxBB
63+
OCJv88Frx7qdbu8eSV0OviuaM/B7ky2NbDMKIybX4tf/Q8FNfjPLvTv+8nbrMz6kTno3RR2YC7tt
64+
I7Glb/eOg3F/ouF4wcoPAj+OyU5Q5WJMMaZ9cXF9pwszsglLbFms+WD5PFxlloh6I1hO7TccWKTe
65+
UJ5fYZSYYm31JqWit3DBltXTyRyL7KFSdT/FyRBk62YLCJqJmcukIUJUTya73/RmjW1M4zMBNaIj
66+
/pH77opKWnVbm9F4XnBCG4r9+FRXdV2zKW6DgvDzQ6DaZ+0cwC36vSqkDyjZYv/tviuWfM8=
67+
</ds:X509Certificate>
68+
</ds:X509Data>
69+
</ds:KeyInfo>
70+
</ds:Signature>
71+
<saml:Issuer>https://idp.example.com/</saml:Issuer>
72+
<samlp:Status>
73+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
74+
</samlp:Status>
75+
<saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_bbbbbbbbbbbbbbbbbbbbbbbb" IssueInstant="2000-01-01T01:00:00Z" Version="2.0">
76+
<saml:Issuer>https://idp.example.com/</saml:Issuer>
77+
<saml:Subject>
78+
<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" SPNameQualifier="audience">modifiedFakeNameId</saml:NameID>
79+
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
80+
<saml:SubjectConfirmationData InResponseTo="inResponseTo" NotOnOrAfter="3000-01-01T01:00:00Z" Recipient="https://acs.example.com/"/>
81+
</saml:SubjectConfirmation>
82+
</saml:Subject>
83+
<saml:Conditions NotBefore="2000-01-01T01:00:00Z" NotOnOrAfter="3000-01-01T01:00:00Z">
84+
<saml:AudienceRestriction>
85+
<saml:Audience>audience</saml:Audience>
86+
</saml:AudienceRestriction>
87+
</saml:Conditions>
88+
<saml:AuthnStatement AuthnInstant="2000-01-01T01:00:00Z" SessionIndex="42" SessionNotOnOrAfter="3000-01-01T01:00:00Z">
89+
<saml:AuthnContext>
90+
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
91+
</saml:AuthnContext>
92+
</saml:AuthnStatement>
93+
</saml:Assertion>
94+
</samlp:Response>

‎test/static/unsigned_saml_response.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<samlp:Response
2+
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
3+
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
4+
ID="_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
5+
Version="2.0"
6+
IssueInstant="2000-01-01T01:00:00Z"
7+
Destination="https://acs.example.com/"
8+
InResponseTo="inResponseTo">
9+
<saml:Issuer>https://idp.example.com/</saml:Issuer>
10+
<samlp:Status>
11+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
12+
</samlp:Status>
13+
<saml:Assertion
14+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
15+
xmlns:xs="http://www.w3.org/2001/XMLSchema"
16+
ID="_bbbbbbbbbbbbbbbbbbbbbbbb"
17+
Version="2.0" IssueInstant="2000-01-01T01:00:00Z">
18+
<saml:Issuer>https://idp.example.com/</saml:Issuer>
19+
<saml:Subject>
20+
<saml:NameID
21+
SPNameQualifier="audience"
22+
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">nameId</saml:NameID>
23+
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
24+
<saml:SubjectConfirmationData
25+
NotOnOrAfter="3000-01-01T01:00:00Z"
26+
Recipient="https://acs.example.com/"
27+
InResponseTo="inResponseTo"/>
28+
</saml:SubjectConfirmation>
29+
</saml:Subject>
30+
<saml:Conditions
31+
NotBefore="2000-01-01T01:00:00Z"
32+
NotOnOrAfter="3000-01-01T01:00:00Z">
33+
<saml:AudienceRestriction>
34+
<saml:Audience>audience</saml:Audience>
35+
</saml:AudienceRestriction>
36+
</saml:Conditions>
37+
<saml:AuthnStatement
38+
AuthnInstant="2000-01-01T01:00:00Z"
39+
SessionNotOnOrAfter="3000-01-01T01:00:00Z"
40+
SessionIndex="42">
41+
<saml:AuthnContext>
42+
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
43+
</saml:AuthnContext>
44+
</saml:AuthnStatement>
45+
</saml:Assertion>
46+
</samlp:Response>

0 commit comments

Comments
 (0)